Overview
overview
7Static
static
3eabe803357...18.exe
windows7-x64
5eabe803357...18.exe
windows10-2004-x64
5$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...in.dll
windows7-x64
3$PLUGINSDI...in.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$R0.dll
windows7-x64
7$R0.dll
windows10-2004-x64
72345BatchRename.dll
windows7-x64
12345BatchRename.dll
windows10-2004-x64
12345EditorApp.dll
windows7-x64
12345EditorApp.dll
windows10-2004-x64
12345Extract.dll
windows7-x64
12345Extract.dll
windows10-2004-x64
12345Image.dll
windows7-x64
12345Image.dll
windows10-2004-x64
12345ImageApp.dll
windows7-x64
12345ImageApp.dll
windows10-2004-x64
12345ImageCapture.dll
windows7-x64
12345ImageCapture.dll
windows10-2004-x64
12345MiniPage.exe
windows7-x64
2345MiniPage.exe
windows10-2004-x64
2345PdfApp.dll
windows7-x64
12345PdfApp.dll
windows10-2004-x64
12345PdfReader.exe
windows7-x64
2345PdfReader.exe
windows10-2004-x64
2345Pic.exe
windows7-x64
2345Pic.exe
windows10-2004-x64
2345PicEditor.exe
windows7-x64
2345PicEditor.exe
windows10-2004-x64
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 06:16
Static task
static1
Behavioral task
behavioral1
Sample
eabe80335778b6495bb615345c9dca08_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eabe80335778b6495bb615345c9dca08_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FileInfo.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FileInfo.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/RCWidgetPlugin.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/RCWidgetPlugin.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$R0.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$R0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
2345BatchRename.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
2345BatchRename.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
2345EditorApp.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
2345EditorApp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
2345Extract.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
2345Extract.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
2345Image.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
2345Image.dll
Resource
win10v2004-20240910-en
Behavioral task
behavioral19
Sample
2345ImageApp.dll
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
2345ImageApp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
2345ImageCapture.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
2345ImageCapture.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
2345MiniPage.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
2345MiniPage.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
2345PdfApp.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
2345PdfApp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
2345PdfReader.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
2345PdfReader.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
2345Pic.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
2345Pic.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
2345PicEditor.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
2345PicEditor.exe
Resource
win10v2004-20240802-en
General
-
Target
$PLUGINSDIR/FileInfo.dll
-
Size
118KB
-
MD5
8a9d5a3fd88e9c063c2012d05d3810da
-
SHA1
67e18733c396e224d0458ccc26058ff58b381424
-
SHA256
900002e96c907dcc569ae694ac36594fba6b42f3a17a71dcc316997b39abd9e3
-
SHA512
0e11a8070e997841440d117219de997831674241d53b5ddf6b08c937a0fab0f7edeb9e605ca79ae643daade2422aec23b07549eda784c44947161b03c30364a3
-
SSDEEP
1536:nuS+ho3wr5iBRN6ZZHSnbZy1M7MgYOza3EBNxRha+11cdsWjcd3mEMpDlwjJjvuD:n5/wrqN60c1M7VX6My+113mEMpDuJDuD
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2788 2776 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2704 wrote to memory of 2776 2704 rundll32.exe 30 PID 2704 wrote to memory of 2776 2704 rundll32.exe 30 PID 2704 wrote to memory of 2776 2704 rundll32.exe 30 PID 2704 wrote to memory of 2776 2704 rundll32.exe 30 PID 2704 wrote to memory of 2776 2704 rundll32.exe 30 PID 2704 wrote to memory of 2776 2704 rundll32.exe 30 PID 2704 wrote to memory of 2776 2704 rundll32.exe 30 PID 2776 wrote to memory of 2788 2776 rundll32.exe 31 PID 2776 wrote to memory of 2788 2776 rundll32.exe 31 PID 2776 wrote to memory of 2788 2776 rundll32.exe 31 PID 2776 wrote to memory of 2788 2776 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FileInfo.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FileInfo.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 2243⤵
- Program crash
PID:2788
-
-